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X86-to Tapestry transition exception handler ^ 

II This handler is entered under the following conditions: 
// 1. An x86 caller invokes a native function 
// 2. An x86 function returns to a native caller 

// 3. x86 software returns to or resumes an interrupted native function following 
// an external asynchronous interrupt, a processor exception, or a context switch 
^321 

dispatch on the two least-significant bits of the destination address { 
case"00" // calling a native subprogram 

// copy linkage and stack frame information and call parameters from the memory 
// stack to the analogous Tapestry registers 
LR -^[SP++] // set up linkage register^''^^ 
AP -^SP // address of first argument-^'^'^'* 32g 

SP SP - 8 // allocate return transfer argument area 007 
SP -i- SP & (-32) // round the stack pointer down to a 0 mod 32 boundary -^^^ ' 

XD-^ 0 // infomn cailee that caller uses X86 calling conventions 328 

case "01 " // resuming an X86 thread suspended during execution of a native routine ^ 
if the redundant copies of the save slot number in EAX and EDX do not match or if 1 07 
the redundant copies of the timestamp in EBX:ECX and ESI:EDI do not match { J 
// some form of bug or thread corruption has been detected 
goto TAPESTRY_CRASH_SYSTEM( thread-corruption-error-code ) 372 

save the EBX:ECX timestamp in a 64-bit exception handler temporary register 1^70 

(this will not be overwritten during restoration of the full native context) J 
use save slot number in EAX to locate actual save slot storage — 374 
restore full entire native context (includes new values for all x86 registers) 
if save slot's timestamp does not match the saved timestamp { ~^376 
// save slot has been reallocated; save slot exhaustion has been detected 
goto TAPESTRY_CRASH_SYSTEM( save-slot-overwritten-error-code )^ .__ 

free the save slot " 

case"1 0" // returning from X86 cailee to native caller, result already in registers 

RV0<63:32> -^edx<31 :00> // in case result is 64 bits 333 

convert the FP top-of-stack value from 80 bit X86 form to 64-bit form in RVDP ^~->v^oo>i 
SP -^ESI // restore SP from time of call--^337 '^'^^ 

case"11" // returning from X86 cailee to native caller, load large result from memory 
RV0..RV3 — load 32 bytes from [ESI-32] // (guaranteed naturally aligned) 
SP-^ESI // restore SP from time of call 

} 

EPC-^EPC & -4 // reset the two low-order bits to zero 
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/ 

Tapestry-to-X86 transition exception handler 

// This handler is entered under the following conditions: 

// 1 . a native caller invokes an x86 function 

// 2. a native function returns to an x86 caller 

switch on XD<3:0> { -x 

^341 

XD_RET_FP: // result type is floating point 

FO/FI ^ FINFLATE.de( RVDP) // X86 FP results are 80 bits 
SP^ from RXA save // discard RXA, pad, ergs 

FPCW-^image after FINIT & push // FP stack has 1 entry 
goto EXIT 

XD_RET_WRITEBACK: // store result to @RVA, leave RVA in eax 

RVA-*-from RXA save // address of result area 

copy decode(XD<8:4>) bytes from RV0..RV3 to [RVA] \, 342 

eax-^ RVA // X86 expects RVA in eax 

SP-^from RXA save // discard RXA, pad , args 

FPCW-*-image after FINIT // FP stack is empty 

goto EXIT 

XD_RET_SCALAR: // result in eax:eda 

edx<31 :00> eax<63:32> // in case result is 64 bits 
SP-»-from RXA save // discard RXA, pad , args 

FPCW-^image after FINIT // FP stack is empty 

goto EXIT 

XD_CALL_HIDDEN_TEMP: // allocate 32 byte aligned hidden temp^ 
esi-^SP // stack cut back on return 

SP-^ SP - 32 // allocate max size temp 1 344 

RVA-»-SP //RVA consumed later by RR J 

LR<1 :0>-^"1 1 " // flag address for retum & reload -\ 

gotoCALL.COMMON 345 

default: // remaining XD_CALL_xxx encodings 

esi^SP // stack cut back on return 

LR<1 :0> -^"1 0" // flag address for retum ^ 343 

CALLCOMMON: 347 ^346 

interpret XD to push and/or reposition args -J 
[~SP] ^ LR // push LR as return address 

EXIT \- 348 

setup emulator context and profiling ring buffer pointer 

} /-349 

RFE II to original target 

} 

FIG. 31 
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interrupt/exception handler of Tapestry operating system : 

II Control vectors here when a synchronous exception or asynchronous interrupt is to be 
// exported to / manifested in an x86 machine. 

// The interrupt is directed to something within the virtual X86, and thus there is a possibility 
// that the X86 operating system will context switch. So we need to distinguish two cases: 
// either the running process has only X86 state that is relevant to save, or 
// there is extended state that must be saved and associated with the current machine context 
// (e.g., extended state in a Tapestry library call in behalf of a process managed by X86 OS) 
if execution was interrupted in the converter - EPC. ISA == X86 { 1 
// no dependence on extended/native state possible, hence no need to save any ?-35 1 
goto EIVi86_Deliver_lnteniipt( interrupt-byte ) J 
} else if EPC.Taxi_Active { 

// A Taxi translated version of some X86 code was running. Taxi will rollback to an ^ 
// x86 instruction boundary. Then, if the rollback was induced by an asynchronous extemal 
// interrupt. Taxi will deliver the appropriate x86 interrupt. Else, the rollback was induced 
// by a synchronous event so Taxi will resume execution in the converter, retriggering the 
// exception but this time with EPC.ISA == X86 

goto TAXi_Rollback( asynchronous-flag, inten^upt-byte ) , 
}elseifEPC.EM86{ < 
// The emulator has been interrupted. The emulator is coded to allow for such 
// conditions and permits re-entry during long running routines (e.g. far call through a gate) 
// to deliver external intermpts 
goto EM86_Deliver_lnterrupt( inten^jpt-byte ) 



>353 



^354 



} else { 



// This is the most difficult case - the machine was executing native Tapestry code on ^ 
// behalf of an X86 thread. The X86 operating system may context switch. We must save 
// all native state and be able to locate it again when the x86 thread is resumed. 
^361 

allocate a free save slot; if unavailable free the save slot with oldest timestamp and try again 
save the entire native state (both the X86 and the extended state) 1 oeo 

save the X86 EIP in the save slot J ^^"^ 353 

ovenwrite the two low-order bits of EPC with "01 " (will become X86 interrupt EIP) )^ 360 

store the 64-bit timestamp in the save slot, in the X86 EBX:ECX register pair (and, 

for further security, store a redundant copy in the X86 ESI:EDI register pair) j '^^'^ 
store the a number of the allocated save slot in the X86 EAX register (and, again for "1 

further security, store a redundant copy in the X86 EDX register) j -^"^ 

goto EM86_Deliver_lnterrupt( inten^upt-byte ) -\ 

^369 
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typedef struct { 
save_slot_t * 
save_slot_t * 
unsigned int64 
unsigned int64 
unsigned int64 

timestampj 
int 

boolean 
} save_slot_t; 
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newer, // pointer to next-most-recently-allocated save slot 

older; // pointer to next-older save slot 

epc; // saved exception PC/IP 

pew; // saved exception PCW (program control word) 

registers[63]; // save the 63 writeable general registers 

// other words of Tapestry context 

timestamp; // timestamp to detect buffer overrun 



save_slot_ID; // ID number of the save slot 
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save_slotJs_full; // full / empty flag ^ _ _357 
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save_slot_t * 
save slot t * 



save_slot_head; 
save_slot_tail; 



// pointer to the head of the queue 
// pointer to the tail of the queue ^ 
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0.1100 


x86 SYNCHRONOUS/ ASYNCHRONOUSINT!RRUPTW/PROBE(GRP0) 
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1.0000 
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DESCRIPTION OF SIDE-BAND INFORMATION 


INSTRUCTIONS WITH 
Imm6 FIELD 




THE CONVERTER MAYSUPPLYAFULL32-BITIMMEDIATE. 


BRANCHES WITH 
DISPIACEMENT 




THE CONVERTER MAYSUPPLYAFULL32-BITDISPLACEMENT 


LDA/STA 


INTEGER 


AFULL32-BITDISPIACEMENT IS SENT ON THE IMMEDIATE BUS; THIS ISADDED TO 
SRC1 TO COMPUTE THE OFFSET FOR SOME ADDRESSING MODES. 


CJcond 


INTEGER 


THE CONVERTER MAY SPECIFYA 16 OR 32-BIT ADDRESS SIZE IN PARALLEL WITH THIS 
INSTRUCTION (A32-BIT DISPLACEMENT MAY ALSO BE PROVIDED). 


CJcond 


INTEGER 


THE CONVERTER MAY SPECIFYA 16 OR 32-BIT ADDRESS SIZE IN PARALLEL WITH THIS 
INSTRUCTION. A32-BIT DISPLACEMENT MAY ALSO BE PROVIDED, 


FROMPR 


INTEGER 


3-BITS OF TOS (TOP-OF-STACK) ARE SENT ON THE IMMEDIATE BUS IN PARALLEL WITH 
THIS INSTRUCTION FOR USE BY THE FNSTSW INSTRUCTION CONVERTER SEQUENCE. 


LEA 


INTEGER 


A6-BIT INDEX REGISTER SPECIFIER,A32-BITDISPLACEMENT,ANDA2-BIT SCALE 
FACTOR ARE PASSED FROM THE CONVERTER AS ADDITIONAL INPUTTO THE HARDWARE IN 
ORDERTOFORM A COMPLETE x86 ADDRESSING MODE. 


LDAI 


INTEGER 


A6-BIT INDEX REGISTER SPECIFIER,A32-BITDISPLACEMENT.ANDA2-BIT SCALE 
FACTORARE PASSED FROM THE CONVERTER AS ADDITIONAL INPUTTO THE HARDWARE IN 
ORDERTOFORM A COMPLETE x86 ADDRESSING MODE. ADDITIONALLY, A SECOND 
DESTINATION REGISTER IS PASSED AS THE DESTINATION OF THEADDRESS 
AUTOINCREMENTMODE. 


LOOP.LOOPZ, 
LOOPNZ 


INTEGER 


THE CONVERTER MAY SPECIFYA 16 OR 32-BIT ADDRESS SIZE IN PARALLEL WITH THIS 
INSTRUCTION. A32-BIT DISPLACEMENT MAY ALSO BE PROVIDED. 


STAI 


INTEGER 


A6-BIT INDEX REGISTER SPECIFIER,A32-.BITDISPLACEMENT,ANDA2-BIT SCALE 
FACTORARE PASSED FROM THE CONVERTER AS ADDITIONAL INPUTTO THE HARDWARE IN 
ORDERTOFORM ACOMPLETEx86 ADDRESSING MODE. ADDITIONALLY, ASECOND 
DESTINATION REGISTER IS PASSED AS THE DESTINATION OF THE ADDRESS 
AUTOINCREMENTMODE. 


PSHUFW 


MMX 


0NLY6 BITS OF THE ImmSARE STORED IN THE INSTRUCTION. THE REMAINING TWO 
BITS ARE CREATED BYTHE HW CONVERTER. 


FLOA 


FPEP 


A6-BIT INDEX REGISTER SPECIFIER ANDA32-BITDISPIACEMENT,ANDA2-BIT SCALE 
FACTORARE PASSED FROM THE CONVERTER AS ADDITIONAL INPUTTO THE HARDWARE IN 
ORDERTOFORM ACOMPLETEx86 ADDRESSING MODE. 


FST 


FPEP 


1-BIT OF STO VALID IS SENT ON THE IMMEDIATE BUS IN PARALLEL WITH THIS 
INSTRUCTION. 


FSTA 


FPEP 


A6-BIT INDEX REGISTER SPECIFIER ANDA2-BIT SCALE FACTOR ARE PASSED FROM THE 
CONVERTERAS ADDITIONAL INPUTTO THE HARDWARE IN ORDER TO FORM ACOMPLETE 
x86 ADDRESSING MODE. 


FXAM 


FPEP 


1 BIT STO VALID IS PASSED ON THE IMMEDIATE BUS 
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INSTRUCTION 
CONTROL 




INSTRUCTION BOUNDARY INFORMATION: 

-STARTOF INSTRUCTION OR STRING ITERATION 

-LAST OF SEQUENCE 

-FP DP/,,, INTERNMENT CONTROL 

-FP TAG MAPINTERNMENT CONTROL 
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X86 instruction PUSHAD 



Native Instruction Recipe 



950 



Temp := (ESP) 


954—' 
951-^ 


^ IVIOV.64 


tmp_d, ESP /* copy working SP to temp */ 


Push(EAX) 


r STOREDEC.X 


^EAX,SS,tmp 

' ECX.SS,tmp d ^953 


Push(ECX) 


STOREDEC.X 


Push(EDX) 




STOREDEC.X 


EDX,SS,tmp d 


Push(EBX) 




STOREDEC.X 


EBX,SS.tmp d 


Push(Temp) 




STOREDEC.X 


ESP,SS.tmpd 


Push(EBP) 




STOREDEC.X 


EBP.SS.tmpJ 


Push(ESI) 




STOREDEC.X 


ESI.SS.tmp d 


Push(EDI) 


955-^ 


r mm 


EDI,SS,tmp_d 




952^ 


ESP,tmp_d /* commit new SP*/ 
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IDIOM 


USAGE 


LOAD /OP [/STORE] 


LOAD DATA 


COMPLEX ADDRESS CALCULATION 


COMPUTED OFFSET 


MOV mem, [DEFGSJS / PUSH [DEFGS]S 
(SELECTOR PUSH/STORE) 


SELECTOR (PROCESSOR REGISTER NOT DIRECTLY 
ACCESSIBLE BY STORE INSTRUCTIONS) 


PUSHA (PUSH ALL) 


INTERMEDIATE STACK POINTER; COMMIT AT END 


POPA(POPALL) 


INTERMEDIATE STACK POINTER; COMMIT AT END 


MOV mem, Imm/PUSH Imm 


INTERMEDIATE (NOTAVAILABLE AS AN OPERAND TO 
STORE INSTRUCTION) 


MULTIPLY 


INTERMEDIARY TO CONNECT CONTIGUOUS NATIVE 
REGISTER PAIR TO X86 REGISTER PAIR 


DIVIDE 




XCHG 


THE CLASSIC USE OF ATEMPORARY! 


POP mem 


STACK POINTER UNTIL MEMORY OPERATIONS /\RE FINISHED 
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960 



961 



X86 instruction ADD r/m8,r8 
DEST:= DEST + SRC; 



962 
963 

964 

FIG. 9G 



Native Instruction Recipe 
- LDA.b.write_intent tmp_d,Seg.Base,Base 
" ADD.b tmp_d,tmp_d,reg 
STA.b tmp_d,Seg.Base,Base 



967 



X86 instruction CALL r/mX /* near absolute call */ 
IF target instruction pointer is not within code segment limit 

THEN#GP(0);FI; L968 
IF stack not large enough for a 4-byte return address 

THEN#SS(0);FI; L969 
Push(EIP); 
EIF:=EIP + DEST; 



FIG. 9H 



976 



X86 instruction CALL re1X /* near IP-relative call */ 
IF target instruction pointer is not within code segment limit 

THEN#GP(0); Fl; 
IF stack not large enough for a 4-byte return address 

THEN#SS(0); Fl; 
Push(EIP); 
EIP:=EIP + DEST; 

FIG. 91 



^0 



Native Instruction Recipe 
LOAD.Iimit_check rO,CS:reg_d 

^^971 
972 

STOREDEC.X IP.SS.ESP 
JR. reg_d 
^973 



Native Instruction Recipe 



977 

STOREDEC.X IP.SS.ESP 
JR reg_d 

^978 



^80 981 

X86 instruction LOOP immS Native Instruction Recipe 
Count := ECX; 

Count := Count -1; DEC.X ECX,ECX 

IF (Count ==0) C 

THENBranchCond:=1; qoo 

ELSEBranchCond: = 0; 

Fl; CJNE ECX,rO,imm8 



IF (BranchCond ==1) 
THEN 

NextElP := NextElP + SignExtend(DEST); 

IF target instruction pointer is not with code segment limit 

THEN 

#GP(0); r ECX not modified */ 
ELSE 
ECX := COUNT; 
EIP:= NextElP; 

Fl; 
ELSE 
ECX := Count; 

Terminate loop and continue program execution at EIP; 
Fl; 

FIG. 9J 



^983 



986 987 

X86 REPNZ MOVS 988f S^-^.k.^ ?Pr^' 

WHILE ECX ^ 0 1 STOREINC (lest++.tmp_d 

DO 989-^'^'^^ predicted not taken 

service pending inteniipts (if any); 991 J pSii^iM^ ^^r^' 

execute associated MOV instmction; ^ ,JS^^^^^ ^^^^^-^P-?, . 

ECX := ECX- 1; QfiQ^l'K? u P^®^'?®^ 

IP ECX = 0 '■^^•^ tmp_d, src++ 

THEN exit WHILE loop; ?J9'^^'^^ ^^sH+.tmp.d 

IFZF = 1 989^ predicted not taken 
THEN exit WHILE loop; 

Fl; 
CD; 



FIG. 9K 



